UK OFSI imposes £165k penalty on Deutsche Bank AG London Branch for Russia sanctions breach — second Settlement Scheme resolution

Mechanism

The penalty enforces regulation 12 of the Russia (Sanctions) (EU Exit) Regulations 2019 — the prohibition on making funds available to a designated person or to a person owned or controlled by a designated person. DBLB's breach: two payments cleared in June and July 2022 on behalf of a customer to Okko LLC, a Russian app developer and streaming-platform operator that was at that time wholly owned by JSC New Opportunities, which had been designated under the Russia Regulations.

Root cause — third-party screening data lag. DBLB relied in part on a third-party sanctions-screening provider whose data did not reflect the post-listing ownership change: Sberbank had transferred its digital assets to JSC New Opportunities (the designated entity), making Okko a 100%-owned subsidiary of a designated person. Media reports published in May 2022 had covered the Sberbank-to-JSC-New-Opportunities digital asset transfer, but this information was not captured in the screening database DBLB used. OFSI's published notice emphasises that firms cannot delegate their sanctions-compliance obligations to third-party providers and must understand the limitations of such tools, supplementing them with internal controls and open-source monitoring.

Penalty calculation:

1. Baseline penalty: £300,000 — reflecting the breach value (~£635,618.75 across two transactions) and OFSI's case-categorisation methodology. 2. 45% discount applied for DBLB's voluntary self-disclosure (made to OFSI on 20 September 2022) and cooperation throughout the investigation. 3. Final penalty: £165,000.

The case was assessed as "serious" under the 2026 monetary- penalties methodology (the same severity tier as Bank of Scotland and Apple Distribution International, the two prior 2026 OFSI enforcement cases).

Settlement Scheme mechanics. Formal settlement discussions opened on 4 March 2026 under transitional arrangements (applicable to matters where an OFSI notice of intention was issued before 9 February 2026 but no final decision had yet been reached). Settlement was agreed and the penalty notice issued on 30 April 2026, published 19 May 2026. DBLB is the second case resolved via the new Settlement Scheme (the first was ADI — Apple Distribution International, settled 19 March 2026) and the first involving a major investment-bank counterparty.

Enforcement-typology taxonomy — third breach type in 2026

The three 2026 OFSI Settlement-Scheme resolutions cover structurally distinct breach patterns:

DBLB's case extends the register's OFSI enforcement taxonomy into the ownership-aggregation screening-data-quality failure mode — the hardest breach type to monitor operationally, because it requires continuous surveillance of ultimate beneficial ownership across sanctioned-jurisdiction digital asset transfers, not just name matching against static designated-persons lists.

Why severity 2

• Small absolute penalty. £165,000 is immaterial to Deutsche

Bank's balance sheet. No structural compliance remediation visible in public disclosures.

• Russia regime unchanged. The action enforces existing

2019 Russia Regulations against a single payment-chain exposure. No new designations, no sectoral extension, no new prohibitions.

• Compliance precedent is the real story. Establishes

that reliance on third-party screening data does not discharge an institution's obligations when that data fails to capture post-listing ownership changes. Second resolution under the new Settlement Scheme gives compliance counsel a second data point on the discount range and timing of the scheme. Severity 3 would overstate the market impact; severity 1 would understate the enforcement signal for financial-sector compliance architecture.

Downstream implications

• Third-party screening vendor liability. OFSI's published

reasoning reinforces that the "my vendor missed it" defence is not a mitigation of the breach, only of the penalty (via voluntary disclosure). Financial institutions should audit vendor update-cycle latency for post-listing corporate-structure changes, particularly for sanctioned-jurisdiction digital-asset portfolios.

• Correspondent banking architecture. DBLB's role as

clearing/correspondent bank highlights residual Russia exposure in correspondent payment flows. Compliance teams should review whether all sub-£1M payment corridors involving Russia-adjacent entities are covered by enriched ownership-tracing (not just name matching).

• Settlement Scheme cadence. Two resolutions in six

weeks (ADI: 19 March; DBLB: 30 April) suggests OFSI is clearing a pre-9-February 2026 enforcement backlog at pace. Expect additional Settlement Scheme cases in Q2-Q3 2026.

Open questions

• Whether the 45% DBLB discount vs. 35% ADI discount signals

a calibrated schedule (speed-of-disclosure + cooperation depth) or case-specific negotiation. A third case will help confirm the discount range.

• Whether data vendors publish updated latency benchmarks

for sanctioned-entity ownership-chain monitoring following this public notice.